We found the issue in the Python code. This TA was installed on a search head that was configured to utilize an index cluster as it's search peers. The search head itself is not part of a search head cluster. However, the Nessus TA thinks it is part of a cluster. In the app directory in /bin/splunk_ta_nessus/splunktaucclib/data_collection, there is a piece of code called ta_mod_input.py. In the run() function of that script, there is a section that resembles the following: if tconfig.is_shc_but_not_captain(): # In SHC env, only captain is able to collect data stulog.logger.debug("This search header is not captain, will exit.") return Once we commented out this code, we began seeing communications with the Security Center server. We investigated this further to determine why this was happening. Part of the script looks to the server roles of the Splunk instance by calling the REST service at https://SPLUNKSERVER:8089/services/server/info. It looks to see if one of the roles is "cluster_search_head". If it is, it then looks to see if this search is the captain of the cluster and only if it is, does it allow the input to occur. We did some testing and found that because this search head utilizes an index cluster for it's search peers, this role does appear. SOLUTION 1. Comment out this code. (Not recommended as it will be over written in future upgrades.) 2. Do not install this TA on any search heads. Instead, install on a forwarder or indexer to extract the data. ... View more

I found an answer to this question from a colleague. The BaseCellRenderer is called sequentially for each column of the output. Therefore, it will touch each cell leading up to the last column where I want to create my action link. Because of this, you can write script for each column to capture that column's value and hold it in a temporary JavaScript variable. When you render the last column, you can pull from the JavaScript variables to the data you need from the record to create the link. In my example, I was working with ps data from Linux and I needed to capture the HOST, COMMAND and ARGUMENTS fields. In my JavaScript, I first created three global variables: var rowHost; var rowCommand; var rowArguments; Then my BaseCellRenderer definition looks something like the following: // Use the BaseCellRenderer class to create a custom table cell renderer var AddMonitorRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cellData) { return true; }, // This render function only works when canRender returns "true" render: function($td, cellData) { switch(cellData.field.toUpperCase()) { case "HOST": rowHost = cellData.value; break; case "COMMAND": rowCommand = cellData.value; break; case "ARGUMENTS": rowArguments = cellData.value; break; default: } if(cellData.field == "Action") { $td.html('<div align="right"><a href="#" onclick="addMonitor(\'' + escapeJSValue(rowHost) + '\',\'' + escapeJSValue(rowCommand) + '\',\'' + escapeJSValue(rowArguments) + '\')">Add to Monitor</a></div>'); } else { $td.html(cellData.value); } } }); This does a couple of things: The canRender function always returns a value of true. This way, the renderer class will fire for each column of the result set. In the render function, I test to see which field the renderer is currently running for (HOST, COMMAND, ARGUMENTS) and then I store that column's value in the appropriate global variable. In the final if statement, if I am in my Action column (this was a dummy value that I added to my search criteria using | eval Action = 1 ), then I display a link to my addMonitor() function. (NOTE: The escapeJSValue() function is a custom function I have in another part of my code.) If I am not in my Action column, then simply display that column's field value. I added this cell renderer to my TableView and rendered the table and my action appears and works correctly. ... View more